From f16feb5119a87f5e683be7e8916c060abfb0e8d6 Mon Sep 17 00:00:00 2001 From: Roberto Sassu Date: Wed, 6 Oct 2010 18:31:32 +0200 Subject: ecryptfs: added ecryptfs_mount_auth_tok_only mount parameter This patch adds a new mount parameter 'ecryptfs_mount_auth_tok_only' to force ecryptfs to use only authentication tokens which signature has been specified at mount time with parameters 'ecryptfs_sig' and 'ecryptfs_fnek_sig'. In this way, after disabling the passthrough and the encrypted view modes, it's possible to make available to users only files encrypted with the specified authentication token. Signed-off-by: Roberto Sassu Cc: Dustin Kirkland Cc: James Morris [Tyler: Clean up coding style errors found by checkpatch] Signed-off-by: Tyler Hicks --- fs/ecryptfs/keystore.c | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'fs/ecryptfs/keystore.c') diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c index e7f029f00c6b..b1f6858a5223 100644 --- a/fs/ecryptfs/keystore.c +++ b/fs/ecryptfs/keystore.c @@ -459,6 +459,15 @@ ecryptfs_find_auth_tok_for_sig( if (ecryptfs_find_global_auth_tok_for_sig(&global_auth_tok, mount_crypt_stat, sig)) { + /* if the flag ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY is set in the + * mount_crypt_stat structure, we prevent to use auth toks that + * are not inserted through the ecryptfs_add_global_auth_tok + * function. + */ + if (mount_crypt_stat->flags + & ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY) + return -EINVAL; + rc = ecryptfs_keyring_auth_tok_for_sig(auth_tok_key, auth_tok, sig); } else -- cgit v1.2.3